nx_tls13_server_session_emit_certreq.nx
buildroot/runtime/nx_tls13_server_session_emit_certreq.nx
about
nx_tls13_server_session_emit_certreq.nx -- R7 rung 7a: emit CertificateRequest as a real encrypted server
handshake step. The on-wire half of mTLS rung R2 (the live terminator sends it; request-NOT-require).
Sits between EncryptedExtensions and the server Certificate (RFC 8446 ยง4.3.2 ordering): EE, CertReq, Cert,
CertVerify, Finished. Mirrors nx_tls13_server_session_emit_ee exactly: build the CertReq inner bytes (via
the R2 builder, advertising Ed25519 0x0807 + ECDSA-P256 0x0403), AEAD-encrypt as a CT_HANDSHAKE record
under server_hs_traffic_key, write it, feed the PLAINTEXT into the transcript. State stays CERT_SENT (like
emit_certificate), so the existing emit_certificate -> emit_cv -> emit_sf chain is unchanged.
REQUEST-NOT-REQUIRE / never-lockout: emitting this only ASKS the client for a cert; a client that presents
none still completes the handshake (the run loop's mTLS variant decides whether to require it for ACCESS).
license_tier: ORIGINAL expect_exit: 0
dependencies 6 imports · 1 importers
imports: nx_syscalls.nxnx_tls13.nxnx_tls13_record.nxnx_tls13_transcript.nxnx_tls13_server_session.nxnx_tls13_emit_certificate_request.nx
imported by: nx_tls13_server_session_run_mtls.nx
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 20 | const NX_CRQ_REC_HEADER: i64 = 5 |
| 21 | const NX_CRQ_REC_TAG: i64 = 16 |
functions
| 23 | func nx_tls13_server_session_emit_certreq( |
| 74 | func crq_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } |
| 75 | func crq_row(name: *u8, ok: i64) -> i64 { if ok == 1 { crq_w(" PASS " as *u8) } else { crq_w(" FAIL " as *u8) } crq_w(name); crq_w("\n" as *u8); return ok } |
| 77 | func main() -> i64 |